Before you paste your resume into an AI tool: a privacy checklist

1. Make a separate editing copy

Keep the original resume locally. In a working copy, remove your name, personal email, phone number, full address and identifying links when they are irrelevant to the editing task. Remove reference contact details, identification numbers and confidential client or employer information. The OPC advises using altered identifying details and avoiding other people's personal information.^[1]

Retain only the experience needed for the question. An employer name, unusual project and exact dates can still identify a person in combination. Removing a contact header does not guarantee anonymity. The OPC's generative-AI principles recommend de-identified information where possible and limiting collection to what the purpose requires.^[2]

2. Check training use and retention separately

Look for clear answers about whether prompts or uploaded files may be used to improve models, whether that use can be disabled for your account and how long the material is retained. Check which setting applies to the actual service and account you are using. Treat training use and storage as separate questions rather than assuming one control answers both.^[1][2]

A useful decision record is: the task, what you will upload, the applicable privacy notice, the relevant settings and anything still unclear. The OPC's principles distinguish a service's primary purpose from secondary uses such as model training and call for clear information about collection, use and retention. If you cannot establish an acceptable answer, use a less revealing excerpt or another editing method.^[2]

3. Check sharing and processing locations

Read the notice for who can access the information, whether it goes to other service providers and whether processing can occur outside Canada. If the explanation is unclear, ask the provider. The OPC's cross-border consumer guidance encourages transparency and an individual assessment of the risks. Its January 2009 publication is foundational guidance, not a current certification of any AI service.^[3]

4. Understand what deletion covers

Check whether you can remove uploaded files and conversation history, what the deletion policy says about retained copies and how to contact the provider about your information. The OPC recommends considering chat-history deletion when available. Do not treat a deleted conversation as proof of every downstream deletion or assume it reverses prior use; establish what the service actually promises.^[1][2]

5. Restore personal details and review locally

Ask for feedback on a redacted excerpt, then apply changes to your local original. Restore contact details yourself and check every suggested claim against your actual experience. Reject invented responsibilities, qualifications and metrics. This workflow keeps the AI task narrow and follows the OPC's emphasis on minimizing inputs and checking output accuracy.^[2]

Why current notices matter more than a blanket verdict

The OPC's May 6, 2026 announcement reported concerns about OpenAI's initial training and deployment of ChatGPT. It also reported implemented improvements and commitments to further protections, with the federal complaint found well-founded and conditionally resolved. That historical finding does not establish the current handling of every resume upload or the practices of every AI provider.^[4]

The sources below include older official guidance that was reopened for this article. Use it to frame the questions, then verify the current notice for the specific product and account. This is general privacy guidance for candidates, not legal advice, a security audit or a guarantee that redaction eliminates identification risk.^[1][2][3][4]